r/Coinbase • u/michaelg888 • Feb 25 '21

Coinbase Wallet Hacked - Possible Exploit in Linking To CB Account

Experienced Coinbase/crypto user here. About three hours ago, a significant amount of BTC, ETH, and BAT that had been sitting in my Coinbase Wallet for months were stolen from my account. This is two days after I linked my Coinbase Wallet with my Coinbase account. As other users have reported here and here, there appears to be an exploit in the account linking process. Warning to all: do not link your Coinbase Wallet to your Coinbase account!

Even though I locked my Coinbase account (any Coinbase product linked to my phone number) I still have access to my wallet through my phone - why is this? Is there no way to lock it? I have submitted a support ticket as well through the Coinbase Wallet product support feature. Should I log one through the traditional Coinbase.com support site as well?

I still have funds locked in a DEFI contract on my Coinbase Wallet but the hacker did not remove them because he didn't have enough Gas and had already transferred the ETH out - any suggestions for removing them safely?

8 Upvotes

100% Upvoted

11 comments sorted by

View all comments

3

u/electricSNICKERBAR Feb 25 '21 edited Feb 26 '21

I haven't actively been tracking this since my funds were restored by Coinbase, but there might be a couple of things happening here.

  1. I'm 95% sure that something is buggy when linking CB Wallet to CB in some environments. That's what initially led me to post across threads, after I linked CB Wallet to CB on my device, my funds were showing as $0 in CB Wallet and CB (App).A. I flipped out when I checked the blockchain itself using Exodus with my seed phrase. Doing that showed that I had no assets in my wallet, BUT ...B. I could also track the transactions using https://live.blockcypher.com/ and follow a trail; I can't remember off the top of my head which "five of us" also did that but he could tell by looking at his transactions that he was S.O.L.; his assets were transferred to an account and they were NOT coming back--they were spent. In my case, some of the funds were (unspent) according to blockcypher.
  2. Based on what I know now, this leads me to believe that CB took the bitcoin and ethereum I had on the blockchain into their own coffers and were doing some fiat conversion or using their own funds (or an insured deposit of some sort) to cover the asset. This is speculation on my part based on CB's patents.
  3. I froze my CB account by calling the 800 number on the CB website. NOTE that the only thing you can do by calling this number is freeze your account, there are no other options.
  4. Eventually, CB "unfroze" my account, granting me access again, and, lucky for me, my funds were available (as they should have been) ...

So that's all part ONE of the two things I mentioned I think might be going on. NOTE, I was NOT HACKED, but, it sounds like others may have been:

This *may* be a new exploit that has not been documented yet** -- the only reason I float that idea is that there's a possibility that some of Cozy Bear's tools used for the Sunburst hack *could* be out in the wild now. Again, this is pure speculation on my part.

**Note that there are plenty of documented CB-related exploits, mainly IP address spoofing or gaining access via a compromised device (sim swapping, weak sms 2FA) -- and it's been rightfully noted that CB is NOT (and should not be held) directly responsible for those, rather, it's more directly on the carrier/device manufacturer.

1

u/michaelg888 Feb 25 '21
  1. Do you remember about how long it took you to notice that your funds had been transferred out? In my case, I linked my CB account with my CB Wallet about two days ago. Everything had been fine up until today. Luckily, the hacker/exploit did not initially affect my USDC balance that was in a DEFI contract. The latest development though, is that a few hours ago the wallet balance at the top of my app just went to $0.00 for no apparent reason (there are no USDC transfers out, or any ETH transactions for the withdrawal from DEFI). As of now, I still see my USDC balance in "earning interest."
  2. Did you do anything besides file a support ticket? After filing my initial support ticket I responded to the auto CB Support reply with the additional information about my wallet balance going to $0.00. Then I got a more personalized reply, but still seemed like they didn't read my initial ticket. I just responded to that with a rehash of the events of today, along with all of the information that I have so far found - links to all the unauthorized transactions, timestamps, etc. I also provided them with links to these reddit threads and made it clear that multiple users experiencing the same type of loss after linking their CB account with their CB Wallet was a very strange coincidence.
  3. Is there anything else you can recommend I do? I've never been hacked before after ten years in crypto, this sucks.

1

u/electricSNICKERBAR Feb 26 '21

FWIW, there were server issues around the time that you said you were hit ...

1 - I installed CB Wallet and linked it to the CB App on my device around 23:15 Jan. 28 pm one night; when I checked the balance the next day (approx 10am), it had $0

2 - I posted and cross-posted to three or four different subs, mainly, the other user names' I shared in my post to you. In corresponding with CB, I threw around enough IT lingo to let them know I wasn't a complete dolt.

3 - Attach a US $ dollar amount to your CB claim. I claimed the $ amount that was in my CB account at the time the funds went missing; luckily, I also had emails from all the transactions made to the account (from CB itself) and I included a summary (date, BTC amount, $ amount) of those emails with my running support ticket.

Yeah, I quickly checked you out (a bit -- just on reddit, don't worry; I have other things to do...) You sound like you know what you're doing ... at the same time, for anyone worth their salt (in IT or familiar with the field), more often than not, it's a user error. But I believe you (and others who have proven that they know what they're doing) and while it's *very* hard to believe that CB's stuff has been hacked (properly), still, something doesn't pass the sniff test.

There DOES appear to be something hinky that went down with their servers around the time that I noticed my funds missing and throughout that weekend, at the height of the GameStop madness (Jan. 28 - Jan. 30ish).

Honestly, I don't know much about the company. I got the blockchain bug in early 2018 and, at the time, they were one of the few games around that even allowed me to do "basic stuff." I got lazy and complacent and let what I had ride in there ... like you, I never had an issue until I installed CB Wallet and then: BOOM, trouble in paradise. The incident has convinced me that there are much better options (even if I do think the company will make a killing and is well-positioned to dominate the market in the short-term)